Department of State Treasurer. Policy Manual for Local Governments. Section 85: Insurance and Risk Management

Transcription

1 Department of State Treasurer Policy Manual for Local Governments The material provided herein is for informational purposes only and is not intended to substitute for the advice of the local governmental unit s attorney or guidance from insurance or risk management professionals. Units with specific legal questions should always contact their attorney. Revision Issued: July 2014

2

3 Table of Contents Executive Summary... 1 Part I Risk Identification... 3 A. Introduction... 3 B. Risk Identification Types of Liability... 3 a. Contract Liability... 3 b. Civil Liability Discretionary Immunity Waiver of Governmental Immunity by the Purchase of Insurance The Public Duty Doctrine Liability of Public Servants Civil Liability Under Federal Law Environmental Liabilities Loss of Property Net Income Losses Personnel Losses Occupational Safety and Health Laws and Regulations C. Risk Identification Methods Risk Management Questionnaire Financial Statements Review Inspections and Interviews Part II Risk Evaluation and Control A. Risk Evaluation B. Risk Control Risk Avoidance Loss Prevention and Reduction a. Safety Programs b. Disaster Recovery Plans Noninsurance Transfer for Risk Control C. Risk Financing Risk Retention a. Determining When to Retain a Risk b. Methods of Retaining Risk (1) Noninsurance or pay as you go LGC Page i of iv Revision Issued: July 2014

4 Table of Contents (2) Create Reserve Account (3) Insurance Deductibles (4) Noninsurance Transfer for Risk Financing Insurance a. Property Insurance (1) Fire Insurance and Extended Coverage Endorsement (a) Coinsurance Clause (b) Subrogation Clause (2) Difference in Conditions Policy (3) Equipment Breakdown Boiler and Machinery Insurance (4) Valuable Records Coverage (5) Electronic Data Processing Systems Insurance (6) Automobile Physical Damage Insurance (7) Inland Marine Policies (8) Crime Insurance b. Liability Insurance (1) General Liability Insurance (2) Excess Insurance (3) Umbrella Liability Insurance (4) Automobile Liability Insurance (5) Errors and Omissions Insurance (6) Workers Compensation Coverage c. Reinsurance D. Public Entity Risk Pools E. Public Employee Bonds F. Establishing a Risk Management Policy Part III Accounting and Related Considerations A. Accounting for Transferred Risk B. Accounting for Retained Risk C. Discounting of Claims Liabilities D. Annuity Contracts E. Fund Types Used for Risk Management F. Disclosure Requirements G. Accounting Standards Related to Environmental Liabilities Closure and Postclosure Pollution Remediation Liabilities Part IV Additional Resources A. Public Risk Management Association B. Risk Management Companies LGC Page ii of iv Revision Issued: July 2014

5 Table of Contents C. Risk Transfer and Brokerage Services Part V Exhibit Exhibit A Sample Request for Request for Qualifications Property and Casualty Broker and Risk Management Consulting Services Exhibit B Sample Risk Management and Insurance Questionnaire LGC Page iii of iv Revision Issued: July 2014

6 Table of Contents This page intentionally left blank. LGC Page iv of iv Revision Issued: July 2014

7 Executive Summary The material provided herein is for informational purposes only and is not intended to substitute for the advice of the local governmental unit s attorney or guidance from insurance or risk management professionals. Units with specific legal questions should always contact their attorney. Risk management is the process of planning, organizing, directing, and controlling an organization s resources and activities to reduce and minimize the effects of losses. Efficient and effective risk management activities are fundamental responsibilities of governing bodies and a vital function of the finance officers in North Carolina. To navigate in unpredictable and ever-changing waters, it is essential that all local governments have carefully considered risk management policies and procedures in place. The first step in successful risk management is to identify the potential areas of risk, such as liability, property, personnel, or loss of income. Once the unit has evaluated the identified risks, the next step is to decide how to manage that risk. Risk is handled either through risk control techniques, which eliminate, reduce or minimize the losses faced by the unit, or through risk financing techniques, which utilize various alternatives to provide funds for accidental losses that may occur despite risk control efforts. Avoiding a risk may be preferable in some circumstances. However, avoidance is not always possible. Loss prevention or reduction is an effective method of risk control. Other loss exposures can be transferred to other entities by leasing assets or utilizing independent contractors. Loss exposures are financed by either retaining some or all of the risk within the unit or by transferring that risk to other entities through insurance or other transfer methods. A vital step to a risk management program s success is a risk management policy that is supported by the local government s top management. If the unit has transferred the risk of loss to another entity, the expenditure or expense for the premium should be recorded in the period it is incurred and is measurable as an expenditure or expense and related liability of that period. Risks of loss that have not been transferred to another entity should be reported in the financial statements of the local government as an expenditure or expense and as a liability if both of the following conditions are met: Information available before the financial statements are issued indicates that it is probable that an asset has been impaired or a liability has been incurred at the date of the financial statements, and The amount of the loss can be reasonably estimated. If both conditions are not met but there is a reasonable possibility that a loss has occurred, then the risk of loss should be disclosed in the notes to the financial statements. LGC Page 1 of 82 Revision Issued: July 2014

8 Executive Summary Local government units that account for risk financing in a single fund should do so in either the general fund or in an internal service fund. However units account for risk, certain disclosure formation is required in the notes to the financial statements. LGC Page 2 of 82 Revision Issued: July 2014

9 Part I. Risk Identification A. Introduction Risk management is the process of planning, organizing, directing, and controlling the resources and activities of an organization in order to avoid, prevent, reduce or minimize the adverse effects of accidental losses at the least possible cost. The two main elements of risk management are risk control, which is avoiding, reducing or minimizing any losses, and risk financing, which is using various techniques to provide funds for accidental losses which may occur despite risk control efforts. Risk management emphasizes pure risk, which is the risk that certain events will result in losses if they occur. Speculative risk, or the risk of gains and losses from investments or other such activities, is not considered here and is beyond the scope of this discussion. The ultimate objective of all risk management activity is to preserve the unit s assets as well as its ability to function. To accomplish successful risk management, the local government must first identify the areas of risk for the unit by utilizing various identification tools. The government will then need to evaluate the risks it is facing to ascertain the best way to handle each one. Once a risk is evaluated, the unit can elect to avoid, reduce, retain, or transfer the risk, depending on the potential losses resulting from the risk and the financial condition of the unit involved. B. Risk Identification The starting point for effective risk management is to identify the potential areas of risk. Failure to recognize a potential loss will inevitably lead to a failure to provide for the consequences. The risk manager should seek to identify both insurable and uninsurable risks and attempt to determine their financial impact on the unit. The most effective risk identification is accomplished by an individual who is knowledgeable about all areas of the organization. Local governments can experience losses through liability exposures, property exposures, personnel exposures, or the loss of income. All these exposures may potentially result in the impairment of assets. Numerous tools such as questionnaires, interviews, observations, and financial statement analysis will assist the manager in identifying the areas of risk. 1. Types of Liability The following discussion on liability is intended to provide reader some basic information on the topic of liability exposure for units of government. This topic is ever changing and professionals should be consulted for in depth discussion in this area. a. Contractual Liability Contractual liability is the liability assumed under any contract or agreement. Purchasing agreements, leasing contracts, service contracts, and construction contracts all expose the unit to contract risk. Many contracts and licensing agreements contain a "hold harmless" clause in which one party agrees to hold the other harmless because certain liabilities are assumed by the first party. A unit that fails to recognize this potential liability to other entities may expose itself to significant, unexpected liabilities. Also, the failure by a local government to comply LGC Page 3 of 82 Revision Issued: July 2014

10 Part I. Risk Identification with contractual requirements exposes the unit to charges for breach of contract. To avoid potential contract liability, the risk manager should review all contracts for conditions, role clarity, and terminology before they are accepted by the unit. As an alternative, the unit can develop standard wording to use in all contracts that limits the risk assumed by the local government. Once the standard is developed, the risk manager will only need to review those contracts that vary from that standard wording. No governmental immunity exists for contract liability; regardless of the activity which a contract is associated with, the local government will be held to the same performance standard that a private organization would be. Governmental immunity in North Carolina is discussed under the following heading: "Civil Liability under North Carolina Law. b. Civil Liability Another area of potential risk is that of civil or tort liability. A tort is a civil wrong for which an individual who is injured in person or property can recover a monetary award from the alleged wrongdoer. Tort laws function to make the person who has injured another person pay for that injury and also to deter people from engaging in conduct that is likely to cause personal injury or property damage. To identify the potential liabilities facing local governments, liability under both North Carolina law and federal law must be explored. The following discussion is drawn from "Civil Liability of the Local Government and Its Officials and Employees (2007) by Anita R. Brown-Graham, which can be found in County and Municipal Government in North Carolina, available from the School of Government at the University of North Carolina at their website, Civil Liability under North Carolina Law Civil liability under North Carolina law arises from intentional acts or from negligence that causes personal injuries or property damage. Intentional acts are those that cause personal injury or property damage without consent or legal excuse. Examples of intentional or wrongful acts are assault, battery, false imprisonment, false arrest, malicious prosecution, defamation, and trespassing. Civil liability also can occur for a negligent act. The law imposes a duty on each person, including public servants to use reasonable care in conducting their daily affairs. A person may be negligent for failing to exercise reasonable care and causing personal injury or property damage to another as a result. A person sued for negligence can invoke the defense of contributory negligence a legal rule that bars recovery by any individual whose own negligence, however slight, contributes to his or her injury. 2. Discretionary Immunity In North Carolina, two types of immunity have typically been granted to local governments. The Constitution of the State of North Carolina and the North Carolina General Statutes confer the power to make ordinances and policies upon the public officials of local governments. Under the doctrine of discretionary immunity, North Carolina courts will not review decisions that have been left to the sound discretion of a local legislative body. If a tort arises out of the passage or repeal of a local government ordinance, the State courts will not impose a liability on the local government for exercising this power. For example, in Hill v. City of Charlotte, 72 N.C. 55 (1875), the LGC Page 4 of 82 Revision Issued: July 2014

11 Part I. Risk Identification city s board temporarily suspended a local ordinance against the use of fireworks inside the city limits. A building was destroyed when fireworks landed on the roof and caught fire. The owner of the building sued the city to recover damages, alleging that the board was negligent in suspending the ordinance that caused the loss. The State Supreme Court denied recovery on the grounds that a municipality is not liable for the exercise or non-exercise of a discretionary power. The Court would not substitute its judgment for that of the local governing body. Note: the owner of the building in the above example may still have some recourse under federal statutes. The second type of immunity provided to local governments in North Carolina is governmental immunity. Under governmental immunity, North Carolina local governments is not liable for the torts of an employee who harms someone while carrying out a governmental function; however, it is liable if the employee commits a tort while engaged in a proprietary activity. Unfortunately this distinction between governmental and proprietary activities is difficult to apply and often results in arbitrary characterizations of a local government s activities. The absence of a precise standard makes it difficult to predict whether a local government will be liable for the torts of an employee who is engaged in a particular activity. Earlier cases have used the following in determining whether an activity is governmental or proprietary: Who traditionally performs the function? Activities historically performed by a government and not engaged in by private corporations have been held by the courts to be governmental activities. Operation of traffic lights, driving a police car, use of a police or fire alarm, zoning enforcement, storm drain maintenance, furnishing water to firefighters, condemnation of property, franchise granting and administration of sanitation programs have all been held as governmental activities in court cases. Is a fee charged for the service? Collection of a user fee is more likely to result in activity to be deemed proprietary by the courts. Who is the primary beneficiary citizens of the community or of the entire state? When a local government engages in activities for the benefit of its residents, the court is more likely to determine that function is governmental in nature. 3. Waiver of Governmental Immunity by the Purchase of Insurance G.S. 153A-435 and G.S. 160A-485 authorizes cities and counties to waive the defense of governmental immunity by purchasing liability insurance. The following are reasons why units may consider waiving governmental immunity: Inability to determine if governmental immunity will protect the government from liability. Desire of governing body to provide citizens compensation for injuries caused by the negligence of the local government s employees in performing governmental activities. Governmental immunity is limited to tort claims. It does not extend to constitutional rights or federal or state statutes. The statutes make it clear that a local government s governing body has full discretion in determining the specific torts to which the insurance applies and who will be covered LGC Page 5 of 82 Revision Issued: July 2014

12 Part I. Risk Identification under it. The governing body is under no obligation to purchase insurance. If insurance is purchased by a local government, a person who sues may not recover more than the policy amount for his or her injuries, even if injuries exceed the policy limits. If the local government s insurance policy involves a deductible, the local government retains governmental immunity for damages that fall within the amount of the deductible. A unit of government may waive its governmental immunity by: Purchasing insurance that includes liability coverage provided by companies licensed to provide insurance in the state; or Participation in a local government risk pool; or Explicitly setting aside a sum to cover claims against the unit. 4. The Public Duty Doctrine Certain local government activities do not create liability to individual members of the public under the public duty doctrine. There are circumstances in which a unit of local government has no legal duty to protect an individual citizen from harm caused by a third person. The North Carolina Supreme Court has held that the public duty doctrine, as it applies to local governments, is limited to law enforcement departments when they are exercising their general duty to protect the public. There are two exceptions to the public duty doctrine: (1) When a local government makes an actual promise to the plaintiff to create a special duty or (2) When a special relationship exists between the government and the plaintiff. 5. Liability of Public Servants a. Absolute Immunities Legislative immunity protects local legislators and those executives acting in a quasi-legislative function from personal liability for injuries caused by their acts even if the defendant acted with bad faith. Legislative immunity applies if (1) the defendant was acting in a legislative capacity at the time of the alleged incident and (2) the defendant s acts were not illegal. b. Judicial Immunity Judges and prosecutors are protected from civil liability for errors committed in the discharge of their judicial duties. Members of local quasi-judicial boards, such as the planning board or board of adjustment, also have judicial immunity when acting in their quasi-judicial capacity. c. Qualified Immunities Public official immunity protects public officers from liability for negligent activity unless they act with malice, for corrupt reasons, or outside the scope of his or her official duties. A public employee, on the other hand, is not protected under public official immunity. Therefore, public employees may be held personally liable for injuries caused by their negligence during the course of performing their duties. LGC Page 6 of 82 Revision Issued: July 2014

13 Part I. Risk Identification (1) Defining Public Officers The distinction between Public Employees and Public Officers is important due to significant difference in liability exposure. In early years case law defined public officers as: Position created by legislation Normally took an oath of office Performed legally imposed duties, and The incumbent exercised a certain amount of discretion. The court of appeals in more recent case law has used one factor whether a position was created by statute almost to the exclusion of all others. (2) Defining Pubic Employees Public Employees are characterized by persons that act mostly at the direction of others and have duties that are more administrative than discretionary in nature. 6. Civil Liability under Federal Law A local government s liability under federal law is completely different from liability under State law. Under Federal law, 42 U.S.C. 1983, a person is authorized to sue and recover damages against a government or its officers for violations of federal constitutional or of statutory rights when the violations are caused by official conduct. A Section 1983 lawsuit may lead to an award of monetary damages; a declaratory judgment, a statement by the court; or injunctive relief, an order by the court requiring a person to act or refrain from acting in a certain manner. Types of official conduct that can give rise to federal civil liability under Section 1983 are the violation of constitutional rights such as wrongful search and seizure, the right of free speech and political affiliation, or the right to a due process of law. Additionally, Section 1983 authorizes a person, whose rights under a federal statute have been violated, to sue and recover damages. The variety of federal statutes that might be violated and become the subject of a Section 1983 lawsuit are very numerous and are not listed in this manual. A governmental unit may be required to pay monetary damages in a lawsuit brought under Section 1983 only if the violation of federal rights is caused by official policy. (The distinction between governmental and proprietary functions does not determine whether a unit may be held liable under a Section 1983 lawsuit. Those distinctions only apply to suits brought under State law.) The unit may be held liable for damages under Section 1983 if a person s federal rights are violated as a result of the implementation of an ordinance, regulation, or decision that has been officially adopted by the governing board. The unit will not be required to pay damages if the violation of federal rights was caused by an independent, isolated act of an officer or employee who had no authority to set final policy for the unit. For example, a unit is probably not liable under Section 1983 if a police officer makes an illegal arrest in violation of someone s Fourth Amendment rights against wrongful search and seizure, as long as it is not the unit s policy to make such arrests. If the violation was the officer s independent, wrongful act, then the officer may be held personally responsible under federal law LGC Page 7 of 82 Revision Issued: July 2014

14 Part I. Risk Identification even though the officer may still be immune under State laws (based on governmental immunity). Members of governing boards are absolutely immune from personal liability when legislative actions of the board violate someone s federal rights. Absolute immunity means that a council member can never be held personally responsible in a Section 1983 lawsuit for a board action even if the action violates someone s federal constitutional or statutory rights. Such absolute immunity is considered necessary to ensure that local legislators will perform their duties for the public good without fear of personal liability. This grant of absolute immunity extends only to acts taken within the scope of council members legislative duties. For example, board members could not be held personally liable in a Section 1983 lawsuit if the board enacts a zoning ordinance that devalues someone s land so much that it is essentially an unconstitutional taking of property without just compensation. Even though the local government may be liable in this case, the board members involved could not be held personally responsible for the action. They may be held personally liable for acts taken within scope of their administrative duties, although qualified immunity may protect them. Employees and officers (and governing board members who are performing administrative tasks) who violate the federal rights of another person while performing their official duties are entitled to qualified not absolute immunity. A public servant may not be held personally liable in a Section 1983 liability unless his or her conduct violates clearly established statutory or constitutional rights about which a reasonable person in similar circumstances would have known. In other words, public servants are shielded from Section 1983 liability if they could reasonably have thought that their conduct was lawful. 7. Environmental Liabilities Environmental liability is an area of potential loss exposure for local governments. The environmental exposures of a public entity can be divided into two categories: retrospective and prospective exposures. Retrospective exposures are those arising from past operations. It is possible for units to have retrospective exposures of which they are not aware. Recent regulations and public concerns require that units of local government deal with the following issues which could expose units to potential liabilities. Solid Waste and Landfills Hazardous Wastes and Low-Level Radioactive Wastes Water Pollution and Water Resources Groundwater Quality, Sewage Treatment, Including Septic Tanks, Non-point-Source Pollution (runoff from roads, shopping centers, farms and forests), sedimentation pollution, stormwater management, Water Supply Watershed Protection, Floodway and Floodplain Management, Regulation and Restoration of Streams and Wetlands, Drainage Districts, agricultural non-point-source pollution, Soil and Water conservation Air Pollution Indoor and outdoor Coastal Area Management Mountain Ridge Protection LGC Page 8 of 82 Revision Issued: July 2014

15 Part I. Risk Identification 8. Loss of Property Another potential loss exposure for local governments is property loss. Property losses may be either direct or indirect. A direct property loss occurs when an asset is damaged or destroyed as a result of a particular peril. An indirect property loss occurs when an asset loses its value because of damage to some other property. For example, an indirect loss would occur for the going concern value of the assets used for a specific function if a unit discontinues that function. Those assets, which must then be sold separately, may be sold at less than their aggregate value to the unit. Potential property losses are more easily identified than the other types of losses. Risk valuation is the major area of concern with property loss. Property loss covers the risk of damage to all property, real or personal, tangible or intangible that is owned, maintained, or leased by the unit. The value the risk manager should consider regarding real property is the potential loss of the structure based on the current replacement cost. In addition, the risk manager should be familiar with local building codes that may be applicable to partial damage. Building codes may require that the entire building be replaced in accordance with existing code if the building is significantly damaged. To properly assess the risk exposures relating to personal property, the risk manager will need to answer the following questions and many others. How accurate are the fixed asset and inventory records? Cash items - How good are the internal controls and are deposits made daily and properly insured or collateralized? Are the automobiles of the local unit s fleet maintained in good repair? Is there a daily system for checking vehicles before placing them in service? Are the personnel who utilize various vehicles in their course of employment properly licensed to do so? Does the unit have a system in place to check driving records of persons who work with the unit? Does the unit have a policy that discusses number of driver license points or types of motor vehicle violations that would cause a unit of government to take some sort of action? The risk management questionnaire in Exhibit B is devoted in large part to the identification and valuation of potential property losses. 9. Net Income Losses Another major area of risk faced by local governments is that of income loss. Net income losses are decreases in revenues or increases in expenses which occur when an organization s operations cease or are impaired because of a specific event. For example, the tax base of a local government will be severely impaired if a major taxpayer ceases operations. As a result, the unit s revenues may be adversely affected. Units whose activities are financed with grant funds face the risk that the funds will not be available in the future. For units financing facilities with revenue bonds, the debt service for the bonds will still be due even if the revenue source is lost. The governmental unit will only be able to continue functioning effectively and providing the same level of services if the revenue sources currently utilized and relied upon continue to be available. While some income losses may be beyond the control of management, there should be some plan for responding to the loss of income. 10. Personnel Losses A local governmental unit cannot function effectively without key personnel. The loss of personnel may result from resignation, disability, retirement, or death. The effect of the LGC Page 9 of 82 Revision Issued: July 2014

16 Part I. Risk Identification loss on an organization depends upon such factors as the value of the person s services to the unit and the costs associated with replacing that person. The personnel losses incurred by an organization include the costs to replace personnel and the additional health insurance, workers compensation payments, unemployment benefits, pension or death benefits, or other benefits due to the former employee. 11. Occupational Safety and Health Laws and Regulations Few laws affect employers and employees more than the occupational safety and health laws and related regulations. The United States Congress created and President Nixon signed into law in 1970 the Occupational Safety and Health Act, known as OSHA, to protect working people. OSHA s creation culminated a long struggle to find some way to help prevent individuals from being disabled or even killed while earning a living. This prevention-oriented act proposed to preserve our human resources through a combination of research, education and enforcement of occupational safety and health standards. In North Carolina, Department of Labor (DOL) inspectors enforce OSHA laws through a state plan approved by the federal government. As the administering agency for North Carolina, the Department of Labor enforces all current OSHA standards. Units of governments must comply with the Occupational Safety and Health Act of North Carolina ( OSHANC ) standards which can be found in Chapter 95 Article 16 of the General Statutes. A Guide to Occupational Safety and Health in North Carolina is published by the NC Department of Labor and is available at Employers and employees are provided numerous rights and responsibilities under the OSHANC. The following are summarized from A Guide to Occupational Safety and Health in North Carolina (Revised 11/11, pages 4-5) and illustrate some the responsibilities as an employer. This list is not intended to be complete and comprehensive; to substitute for reference to the statute and related regulations; or to replace advice from counsel. Many of your responsibilities were created by the OSH Act. Other responsibilities are detailed within standards that are enforced through the OSH Act. Additional responsibilities have emerged from administrative and judicial resolutions of issues that have arisen under the act. Employers and Information You have the responsibility to: 1 Post in a conspicuous place the N.C. Department of Labor poster North Carolina Workplace Laws, this informs employees of their protections and obligations. Employers may obtain this poster free of charge from NCDOL/ETTA by calling NC-LABOR. 2. Maintain both a log (OSHA Form 300 or its equivalent) of recordable occupational injuries and illnesses and a supplement (OSHA Form 301 or its equivalent) to the log. Employers with fewer than 11 employees are normally exempt. Make both forms available to compliance officers and make Form 300 or its equivalent available to employees. An annual summary of Form 300A must also be posted from February 1 through April 30 each year. LGC Page 10 of 82 Revision Issued: July 2014

17 Part I. Risk Identification 3. Participate in the annual occupational injury and illness survey to assist the commissioner in compiling statistics relative to the incidence of work-related injuries and illnesses. 4. Promptly notify any employee of his or her overexposure to toxic or harmful substances. 5. Report to OSH within eight hours of its occurrence any work-related accident that is fatal to one or more employees or that requires in-patient hospitalizing three or more employees. 6. Post citations for alleged violations of OSH standards at or near the place where the violations allegedly occurred, so that employees are able to read the citations. 7. Post, in a place that will notify employees, copies of any petition for modification of an abatement date and of any amended citation that extends the abatement date. 8. Post a copy of any proposal and/or agreement between the employer and the commissioner to settle the terms of a citation. Monetary penalties assessed by OSH and paid by employers to the Department of Labor are civil (as opposed to criminal ) in nature. The sums collected go into the Civil Penalty and Forfeiture Fund. For any alleged violation classified as serious and for citations for the failure to post items (such as a citation or safety and health poster), the OSH Act requires the assessment of a penalty. For other classifications of employer violations and for failing to abate violations, OSH is given the option of assessing monetary penalties. Willful violations carry a maximum penalty of $70,000 and a minimum penalty of $5,000. Otherwise, the maximum penalty is $7,000. In practice, penalties are always assessed by OSH for alleged violations classified as repeated, willful or serious. Penalties are also assessed when there are 10 or more alleged violations classified as other-than serious. Whenever penalties are assessed, OSH considers the gravity of the violation, the size of the employer being cited, and the good faith and history of the employer in calculating the penalty amount. Smaller units of government normally carry out their responsibilities by working with their workers compensation insurance provider to make arrangement for trained professionals to review the unit of government for OSHA compliance. Larger units have staff (safety officers) that works closely with risk management to help reduce risk exposure. C. Risk Identification Methods 1. Risk Management Questionnaire To help identify these various areas of potential risk, a risk management questionnaire can be an effective tool for risk identification. Such questionnaires are designed to elicit information on the structure, assets, liabilities, operations, and personnel within the organization to help identify areas of potential risk. Local governments can obtain sample questionnaires from several sources. Most insurance companies have questionnaires to help units identify risk, but these often focus on insurable risks only. There are numerous risks that units must be aware of and plan for that are not LGC Page 11 of 82 Revision Issued: July 2014

18 Part I. Risk Identification insurable. Trade associations or risk management literature also are excellent sources for questionnaires. A sample questionnaire is included in Exhibit B. It is important that a manager review the questionnaire closely and modify it as necessary to suit the unit s individual needs. Questionnaires should all address the following points: Owned and leased real and personal property, Income sources, Contractual obligations, Other liabilities besides contractual ones, and Personnel. 2. Financial Statements Review A unit s financial statements also are invaluable in identifying areas of risk. The current fiscal year s budget should be used by the risk manager in conjunction with the financial statements to locate potential losses of income or pending board plans which may expose the unit to excessive risk. The balance sheet can be a starting point for identifying risk. However, since assets are valued at historical cost and not depreciated prior to the implementation of GASB Statement No. 34 Basic Financial Statements and Management s Discussion and Analysis for State and Local Governments, the financial statements may not be an effective tool for valuing risks. Financial statements prepared under the GASB Statement No. 34 model will show accumulated depreciation on the unit s general assets, giving some indication how close the unit may be to increased maintenance or replacement expense. Replacement of aging equipment may reduce risks and possibly insurance premiums. Other sources may need to be consulted to measure these risks. For example, asset entries for an equipment purchase could alert the risk manager to inquire further into the nature of the equipment, its importance to the unit s continuing operations, and the cost to replace the asset. 3. Inspections and Interviews Inspections and interviews with employees are good methods to identify risk. The risk manager will need to talk to employees to ensure that existing safety procedures are being followed and that safety equipment is being used. The best way for the manager to become aware of unsafe activities is to observe them firsthand. Through observation, the risk manager will become familiar with the unit s operations and be aware of situations requiring management s attention. Employees should be questioned about their safety concerns since they are the most familiar with day to day operations. If the risk manager has a good rapport with other managers, the managers will be more likely to ask for advice and to notify the risk manager of any pending activities or plans in their areas of responsibility. The risk manager should be advised of major changes in procedure, significant purchases, and other unit plans since these may all involve potential changes in risk. Strong management contacts will help facilitate this communication. Risk managers should also consider making contacts with risk managers in similar local governments. Historically, North Carolina local government officials have been very cooperative in providing mutual aid. 4. Well-Maintained Loss Records Well-maintained loss records can be invaluable to the risk manager in identifying potential areas of risk. If possible, the records should be maintained for insured as well LGC Page 12 of 82 Revision Issued: July 2014

19 Part I. Risk Identification as uninsured losses. The loss records of other local governmental units also can be helpful in identifying and evaluating risks. LGC Page 13 of 82 Revision Issued: July 2014

20 Part I. Risk Identification This page intentionally left blank. LGC Page 14 of 82 Revision Issued: July 2014

21 Part II. Risk Evaluation and Control A. Risk Evaluation After the risks facing a local government have been identified, the next step is to analyze the likelihood and potential severity of the identified loss. When valuing risk, it is important for the risk manager to remember that certain losses will cost the unit much more than the cost of property replacement. When measuring risks, the manager also should consider any loss of income as well as any costs to recreate the asset (e.g. recreating records of amounts owed to the local government). If possible, the cost of maintaining services during the replacement or repair period should be considered. The purposes of risk evaluation are: To determine the relative importance of each risk, thus saving money by not purchasing excessive insurance, To aid the manager in deciding the best methods to use for risk control and risk financing, and To establish insurable values (both to purchase insurance and to substantiate claims). The two elements of risk are severity and frequency. Severity is the potential size of the loss of each exposure. In other words, severity is the dollar amount of the potential loss to the unit not only from a single event but also over a particular time period. Frequency is the number of times a loss of a given magnitude can be expected to occur. Exact risk evaluations are difficult to determine. For any given period, the average anticipated losses of a particular group can be estimated by multiplying the average frequency of the loss by the average dollar amount of the loss and then adjusting for variables such as inflation, and changes in risk, such as the purchase of several new automobiles for the unit s use. Certified actuaries have numerous tools to value risk and units may elect to use these professionals for such work. Units that are self-insured will most likely use actuaries to determine the expenditures or expenses along with the liabilities to be recorded as required by GASB Statement No. 10 Accounting and Financial Reporting for Risk Financing and Related Insurance Issues. In addition, a unit may use professional judgment or experience to value risks. Probably some combination of these various methods will best suit most units. B. Risk Control Once the risks of a local government have been identified and analyzed, the manager must then decide how to deal with those risks. Risk is handled through risk control or risk financing techniques. Risk control alternatives include: Risk avoidance to completely eliminate the risk, Loss prevention to reduce the chance of a given loss, Loss reduction to reduce the severity of those losses which do occur, or Utilization of noninsurance transfer to transfer the loss exposure to another entity by means other than insurance. LGC Page 15 of 82 Revision Issued: July 2014

22 Part II. Risk Evaluation and Control There is much overlap between the various alternatives to control risk. No category is mutually exclusive and, indeed, some risk control activities performed by a unit may fit into several of these categories. 1. Risk Avoidance One way to control risk is to completely eliminate the risk or the elements causing it. The risk manager should be consulted about acquisition or construction of properties, new services provided by the unit, and major policy changes, etc. that may give rise to new risks so that those risks can be avoided if desired. If the risk manager is not included in the original management decision to begin a certain activity and is informed only after the decision is made, then the opportunity for risk avoidance is lost and any risk management will have to be accomplished through other methods. Obviously, many operational decisions are likely to be made without considering the risk exposures involved, so the risk manager needs to be prepared to use other risk methods of control as well. Examples of risk avoidance would be elimination of high dives at municipal pools and trampolines at recreation facilities. 2. Loss Prevention and Reduction Other risk control techniques are loss prevention and reduction. Reducing the risk can mean reducing the chance of a given loss or reducing the severity of those losses that do occur. A program of regularly scheduled inspections to find any potential loss exposures should be conducted by the safety director, or another knowledgeable employee or consultant. The consultative services division of OSHA is also available to conduct compliance inspections, without threat of fines or penalties. In addition, the N.C. Industrial Commission can provide employee safety training for nominal fees. Department directors should be tasked with primary responsibility for employee safety and thus actively police compliance with safety policies and procedures. Safety measures such as safety glasses, steel-tipped shoes, or protective clothing can reduce the risk of employee accidents. Continual training of all employees and officials about existing safety policies and procedures also is necessary for successful risk reduction. Medical programs that supply employees with both pre-employment and annual physicals can provide employees with knowledge about potential problems. Employee health care, wellness programs, and emergency first aid help improve general employee health and also may reduce health claims in the long-run. a. Safety Programs Safety programs usually work to combine loss prevention and reduction methods to accomplish risk control. For example, assume that a municipality operates a paint department for all city property. The risks associated with this activity are frequent and severe. The risk manager desired to avoid the risk by eliminating the department and contracting out for painting services. However, most of the jobs were so small that independent contractors would not be interested in them. Therefore, the risk manager was unable to avoid all of the risk, but several elements of the risk were eliminated as follows: The paint used to repaint the metal trash cans owned by the city was highly flammable; therefore, the task represented a significant risk. The purchasing manager found attractive plastic trash cans to purchase at the same cost as new metal cans, eliminating the need for frequently repainting the metal trash cans. LGC Page 16 of 82 Revision Issued: July 2014

23 Part II. Risk Evaluation and Control The shop manager eliminated the risk of an explosion by having employees use a water base paint instead of the flammable paints that were being used. The fire hazard that was created by spray painting city vehicles was eliminated by contracting out such work. The local government also may attempt to reduce the severity or loss exposure of the risk. For example, a unit installing a sprinkler system in a building is engaging in the reduction of loss severity. The system will not reduce the possibility that a loss by fire will occur, but it will reduce the financial impact if a fire should occur. Other examples of minimizing loss exposures would be the garaging of unit vehicles in several locations or the storing of backup computer tapes off-site. The governing body should adopt a safety policy for the unit that addresses the scope of the safety program, the role of officials, and the accountability of the staff. Management should appoint a safety director to conduct the required safety studies, develop and monitor safety programs and establish procedures which assure compliance with any federal and State safety requirements. The first step to an effective safety management program is to identify and evaluate the areas of safety concerns facing the unit. Exhibit B contains a risk management questionnaire that will assist the unit in identifying safety risks. Next, the unit should develop and implement a safety plan to reduce any risks identified. To accomplish these goals, a safety policy will need to be developed and supported by the local unit s top management. The roles of a safety director and risk manager are closely related, and the two functions should work together as much as possible to accomplish their similar goals. The above comments address worker safety primarily; however a strong employee safety program will reduce liability exposure as well. In addition, the governmental unit should adopt current human resources policies in high liability areas (such as hiring practices, harassment and discrimination), routinely train employees in these policies and procedures and have employees sign off that they have read and understand the policies. While these activities may not ward off a lawsuit, they do put the entity in a strong position to defend the suit. Other areas of local government liability that should be addressed include current law enforcement policies regarding pursuit, emergency response, arrest, jail operations, entry onto private premises, etc.; driver training; policies to respond to sewer backups; reporting of hazardous conditions on roads, parks, and other public places; proper maintenance of sidewalks and streets, etc. b. Disaster Recovery Plans In recent history, many examples can be cited that demonstrate the need for a comprehensive disaster recovery plan. Disasters such as 911, hurricanes, flooding, bird flu and swine flu along with not so obvious scenarios such as key employees being unavailable (LAN administrator having a serious unplanned medical event). Federal and State agencies can request copies of these plans and expect them to be in place. Electronic data processing (EDP) has become an integral part of operations in local government administration across North Carolina. As more records become LGC Page 17 of 82 Revision Issued: July 2014

24 Part II. Risk Evaluation and Control computerized and more information is distributed electronically, a local government must evaluate what risks it faces from EDP failure. There are two levels of EDP failure to consider, an EDP emergency or a disaster. In this context, an emergency is a serious, but localized situation. While one computer or one computer system may not be functioning as intended, other computers of the local government continue to operate. An EDP disaster would be the widespread failure of computer systems, as what could be caused by a malicious computer virus or the result of tornados or flooding. While the tactics for responding to these different levels may vary, the overall strategies are similar. First, the local government must have a plan. Successful plans will (1) allow for essential government services to continue and (2) the rights of the local government will be protected during the EDP interruption. The following incident illustrates several of these concepts. Once while providing assistance to a local government unit, the State and Local Government Finance Division as staff to the LGC noted that the unit had a backup system for their primary computer. Seven backup tapes were made and were all kept in the unit s safe. However, the safe was never closed because the lock was old and the mechanism was apt to jam. When staff members were asked about this, it was discovered that no tapes were kept off site. After discussion it was decided that the unit s staff would be responsible for rotating the duty of taking one home each night as an additional precaution. Later, as a result of a natural disaster, the centrally stored backup tapes were lost. Upon installation of the backup tape, the unit s personnel discovered that the backup software had not been working correctly. Rather than only a week s worth of data being lost, months of data were missing. The above story is told for illustrative purposes. While the unit had taken some action to protect their records, the effort was incomplete. The backup tapes addressed the problem of a computer system crash, an emergency situation. Because there was no offsite storage, the unit was still vulnerable to a unit-wide disaster. Offsite storage by having responsible staff members rotate the duty of taking one of the backup tapes home of safe keeping would have worked if the backup tapes had been tested to ensure a restoration of records was possible. Increasingly, internet based companies can provide backup services done electronically over the internet. Each unit must decide the cost benefit of their approach. A backup tape is only as good as the information restored from it. Other issues to consider in planning for computer emergencies or disasters would be the human factor. Will there be experienced staff members available? Because an emergency is relatively isolated, personnel or computer support firms are likely to be available. In a disaster, flood waters, fire, or tornado damage may prevent unit staff from being available. Local units should consider what EDP disasters they may be more likely to face and plan accordingly. Finally, all may not be lost in the aftermath of an EDP emergency or disaster. As technology has advanced what computers can do, so technology has advanced what can be recovered from a crashed or damaged computer? If a local government unit wishes to recover information from a damaged computer, the experts recommend LGC Page 18 of 82 Revision Issued: July 2014